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AVIONIC SYSTEM AND GROUND STATION FOR AIRCRAFT OUT OF ROUTE 
MANAGEMENT AND ALARM COMMUNICATIONS 
Technical Field 

This invention relates to an avionic system and ground station for aircraft out of 

5 route management and alarm communications. More particularly, it relates to a 
system for handling events in case of deviations from the authorized flight paths 
and from the pre-set altitude or flight level or spatial limits, and automatically 
transmitting the onboard situation in real time to ground control stations when 
potentially dangerous events occur. 

10 Background Art ^ 

Out of route aircraft caused particularly serious events, including loss of life. This 
situation has been traditionally handled by equipping the plane with flight 
instruments able to display the real time situation to the pilots and to transmit to 
ground the security codes entered by the pilots. Given the inadequacy of said 

15 means to handle complex situations, the above mentioned avionic system and 
ground station allows civil aircraft to temporarily operate independently from the 
pilot, in order to protect the civilian population. This system allows the aircraft to 
automatically react to deviations from the authorized flight paths and from the pre- 
set altitude or flight level or spatial limits, and is able to convey the exact onboard 

20 situation in real time to ground control stations when potentially dangerous events 
occur such as pilot errors, particular atmospheric conditions, failures, chaos, 
hijackings, and so forth. 
Summary of the Invention 

It is the main object of this invention to provide an avionic system and ground 
25 station for aircraft out of route management and alarm communications that is 
able to actively control the aircraft route and convey the onboard situation to 
ground stations in the event of an alarm, effectively increasing aircraft safety and 
security for passengers population and residential areas benefit. 
It is another object of the invention to provide a system that can be easily installed 
30 and used on aeroplanes, in compliance with commercial aviation regulations. 

These objects, and others that shall become readily apparent from the following 
description, are met according to a first aspect of the invention, a control function 
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for managing out of route aircraft (collision avoidance) with the features of claim 1 
and, in accordance with another aspect of the invention by means of a method for 
aircraft out of route management according to claim 9. 

The above functions are performed by an avionic device (which will be certified for 
5 flight) and are suitable for improving the day-to-day flight safety, increasing the 
passengers and the civilian population safety. Implementing the solution in 
accordance with the invention following targets has significant advantages: 
maximum possible safety for the passengers; real time alarms detection and 
appropriate reactions; appropriate emergencies handling; automatic events 
10 detection independently from human intervention; reliable processing of alarm 
signals and secure communication with ground control stations; standardized 
interfaces to allow installation on the greatest possible number of aeroplanes. 
The above functions and targets are achieved by means of a system consisting of 
different elements: an avionic device, which carries out "collision avoidance" and 
15 "alarm" functions; suitable sensors and on board transmitters; a ground control 
station composed by computing systems. The device is installed in a specific 
protected housing of the aircraft; it is not accessible and cannot be disabled from 
the cockpit. 

The first function, "collision avoidance", is performed in the device and intervenes 
20 temporarily and independently of the pilot as soon as the aircraft deviates from the 
pre-set flight path, regardless of the causes. This could occur, for example, if the 
aircraft flyes in not allowed directions or descends below the altitudes/flight levels 
authorized by the air-traffic control regulations. The second function, "alarm", is 
also performed in the device and enables the above mentioned ground control 
25 stations to receive all the necessary information from the aircraft (for example, 
routes data and images) for carrying out appropriate evaluations when potentially 
dangerous events occur. 

Further advantages of the invention shall be readily apparent from the more 
detailed description of a particular embodiment of the invention, given as a non- 
30 limiting example with reference to the following accompanying drawings: 

Figure 1 and 2 show a schematic diagram of an aircraft that uses the system of 
the invention 
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Figure 3 shows a schematic diagram of a runway, which shows approaching 
aeroplane limits and gives an environment indication related to the system of the 
invention 

Description of a preferred embodiment 

5 Figure 1 shows an aircraft that uses the system of the Invention. The authorized 
flight path is the upper one; the permissible limits for said flight path are also 
shown - if the aircraft descends below these limits, the system automatically 
intervenes temporarily by making the aircraft climb to the above said altitude limit 
and informing the ground control stations of the alarm condition (Figure 2). 

10 Figure 3 shows a schematic diagram of an airport runway. The virtual cones set 
the spatial limits for containing the flying aircraft - if the aircraft descends below 
these limits, the system automatically temporarily Intervenes making the aircraft 
climb to a defined limit altitude and informing the ground control stations of the 
alarm condition. To maximize safety the system properly considers the land 

15 orography, buildings, nearby aircraft, the missing approach volumes and the 
authorized circling areas. 

The system, In accordance with the Invention, is composed by an avionic device 
Installed onboard commercial and general aviation aircraft, several sensors and 
transmitters installed in appropriate points of the aircraft, and connections between 

20 said sensors and the avionic device. The system exchanges information with 
ground control stations specifically designed to handle the data transmitted from 
the aircraft and to perform secure communication with the avionic device. 
The avionic device comprises CPU (Central Processor Unit) suitable for handling 
all the data at the required processing speed, specific software, electronic 

25 components; it has memory devices suitable for storing the worid flight paths data 
and relevant limits, the worid's airports positions and relevant limits, any other 
required data; input and output Interfaces suitable for exchanging the required 
information and data between the aircraft, other nearby aircrafts and the ground 
control stations. 

30 The "collision avoidance" function, which is one of the functions carried out by the 
avionic device, is not only used to avoid collisions when the aircraft is flying, but 
also during landing and take-off. When controlling the aircraft route, the unit 
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operates based on the global authorized minimum caiising altitudes and flight 
levels, the so-called "limits", covering every area of the globe, always in 
compliance with all the civil aviation regulations, including the ICAO ones. As a 
non limiting example, when the aircraft is out of route or descends below the said 
5 limits (see Figure 1), the unit automatically temporarily intervenes through 
appropriate connections with the unit itself, the autopilot and the navigation 
system. 

During take-off and landing, the unit operates by creating virtual cones that delimit 
air space and considering the land orography, the flying and ground obstacles. 

10 and all other data of interest (as shown schematically in Figure 3); these data for 
every area of the globe are stored in the storage unit of the system as necessary. 
The "collision avoidance" function is carried out through two states. In the first 
state, the so-called "monitoring state", the unit constantly compares the position of 
the aircraft with the pre-set and stored authorized limits. The unit continuously 

15 receive the data through its interfacing with the navigation system of the aircraft 
and its sensors. The limits depend on the flight areas, the applicable regulations, 
the man-built constructions, obstacles and many other factors. For example, the 
stored data includes the coordinates of all the worid's airports and all the landing 
and take-off procedures established in compliance with the ICAO regulations. All 

20 the necessary information is kept up to date in real time, so that any changes to 
the above parameters are considered when competent authorities or aeronautical 
bodies change it, and this is accomplished through appropriate automatic updating 
procedures performed connecting the unit to ground control stations through data 
links (links described in the alarm function). 

25 In the second state, the so-called "control state", when the aircraft deviates from 
the authorized limits the unit intervenes automatically on the autopilot, through the 
aforementioned interfaces, to take the aircraft to its spatial limit. 
The preferred version of the aircraft out of route management system is as follows: 
in the monitoring state, it allows all the aircraft flying at altitudes or flight levels 

30 higher than the pre-set limit (established by the ICAO regulations for the different 
flight paths) to stay under the direct pilot control, also allowing flight path changes 
above the limit altitude or flight level (alarms will be generated only in case of big 
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flight path changes). The transition to the control state only occurs if the aircraft 
leaves its route to fly in unauthorized directions or descend below the pre-set limit. 
In this case, the unit temporarily takes control of the aircraft, through the collision 
avoidance function, to make the aircraft climb to the pre-set limit. Once the safety 

5 limits have been restored, the system gives the control back to the pilot. 

The preferred version of the collision avoidance function during landing and take- 
off is as follows: for each airport two virtual cones (one in the landing direction and 
one in the take-off direction) are designed via software, in compliance with the 
instrument approach procedure, the missed approach procedure and virtual 

10 circling areas for the concerned runways. When the aircraft is involved in landing 
or take-oft phases, the unit may also command the autopilot and temporarily take 
the control of the aircraft to place it in a predetermined position at a safety height. 
For example, this can occur in the following cases: 

- If during the approach procedure in the landing cone the aircraft suddenly flies 
15 below the cone limits (alarms will be generated if it flies out the cone above the 

limits); 

- If the aircraft flies at a speed considered incompatible with the landing and 
missed approach procedures; 

- If during climbing or after flying over the runway, the aircraft suddenly flies below 
20 the cone limits (alarms will be generated if it flyes out the cone above the limits). 

The collision avoidance function is constantly able to compute the optimal 
climbing flight path and speed to avoid crashing to a ground or air obstacle. It 
accomplishes this by using its and other aircraft speed and position, the protection 
areas, the orography of the land, the artificial obstacles placed near airports, and 

25 any other required information available on board through the a.m. interfaces. 

Additionally other interfaces are foreseen in unit; interfaces with sensors to receive 
row signals In order to calculate automatically an independent present position, 
interfaces with the navigation system to get the present position signals already 
computed by other equipment in order to check the accuracy of the data. 

30 The collision avoidance system may be optionally doubled to make the system 
even more reliable. 
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The second main function canried out by the avionic device, the so-called "alanm 
function", is to allow communication between the aircraft and ground control 
stations or other aircraft. The "alarm function" function is also carried out through 
two states. 

5 The first, the so-called "monitoring state", consists in collecting information on the 
aircraft onboard situation and storing it in the memory unit. This information is not 
automatically transmitted to the ground control stations. In the second state, the 
so-called "alarm state", which is activated in cases of alarm, the unit transmits the 
information generated onboard the aircraft to the ground control stations for 

10 appropriate evaluation. 

To carry out the alarm function, in addition to the avionic unit described above, it is 
required to install on board additional devices, such as miniature surveillance 
video cameras, miniature transmitters that can be worn by the flight crew, 
switches, cockpit locking systems, specific interfaces, and an appropriate 

15 communications system. Suitable ground control stations complete the system. 
Other devices may also be connected when required by regulations or airiine 
specifications. 

A preferred description of the process carried out by the avionic unit to fulfil the 
alarm function is given below. In the monitoring state, the avionic unit has a 

20 "surveillance" role and constantly communicates with the video cameras and 
sensors onboard the aircraft. It records the images and the required information at 
pre-determined time intervals, and stores the information and data for a pre- 
determined amount of time. In this state, through interfaces with the collision 
avoidance function, the unit constantly compares the position of the aircraft with 

25 the expected route in the flight plan; furthermore, the unit continuously 
automatically checks its functions. The system enters the pre-alarm state if a 
hijacking or terrorist act is detected by the sensors or the flight crew, if there is a 
significant deviation from the flight plan or if the cones areas are not respected. In 
this state, a validation request is sent to the nearest ground control station, if this 

30 is not validated within the predetermined time interval by the ground control 
station, the unit will automatically pass from the monitoring state to the alarm state. 
It goes directly in alarm state if the aircraft flies below the a.m. flight limits. 
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In the alarm state, the unit constantly transmits the aircraft navigation data and 
other data (for example, images) to ground control stations, and receives 
messages to the flight crew and passengers. Both in the monitoring and in the 
alarm state, the unit works independently of the pilot and, in the event of attested 
5 terrorist events, it automatically communicates any necessary data to the ground 
control stations. Appropriate measures will be implemented so that, even in the 
case of mechanical damage to the onboard instruments or wiring, the unit is not 
affected. 

The unit have its interfaces with the onboard systems and with the aircraft 
10 communications system in order to communicate all the necessary data with the 
ground control stations. 

The system comprises a number of miniature surveillance video cameras, which 
are installed in appropriate positions depending on the size of the aircraft and are 
wired to the alarm unit. During the monitoring state, the video cameras 

15 automatically send a signal if they have been disabled, damaged, or covered. The 
video cameras transmit the images constantly both to the cockpit and to the unit. 
The system comprises several sensors appropriately connected to the alarm unit 
installed in the aeroplane in appropriate positions depending on the size of the 
aircraft. Preferred sensors are "radio controlled" crew wearable miniature 

20 transmitters that can be operated with switches. These are "radio controlled" heart 
rate monitors for the pilots, switches on board usable by the flight crew. The flight 
crew may manually activate the sensors, sending different impulses to the avionic 
unit in the event of hijacking or a terrorist act; these transmitters are equipped with 
switches and have specific protective mechanisms to protect against false alarms. 

25 Furthermore, switches are located in places that may be accessed by the 
passengers as well. Optionally, in case of alarm the unit could automatically lock 
access to the cockpit. 

The system is completed with suitable ground control stations. Preferably, these 
do not receive information during the monitoring state of the unit. In the pre-alarm 
30 state or when the alarm state is confirmed, the ground control stations receive, 
from the concemed aircraft flying in their range, both the information registered 
before the alarm event and real time information from the aircraft . The ground 
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control stations will perform the following preferred procedure: provide the 
received information to the competent authorities; continuously check the 
correctness of the flight parameters of the aeroplanes under their control when in 
the pre-alarm state and alarm state; constantly check the aeroplane onboard 

5 situation during hijacking and promptly relay the needed information. An adequate 
number of ground control stations will be located for the proper management of 
the system in the locations deemed necessary by the national authorities. The 
stations will include at least the following systems: adequately powerful computers 
with specifications suitable for the functions to be performed, a receiver-transmitter 

10 radio system, an encryption and coding system, an audio-visual-data 
communications system. The onboard/ground/onboard transmission of the 
information will be performed preferably through a data link connection managing 
audio, data radar and video signals and featuring an encryption and coding system 
capable to provide high resistance to jamming. Transmitted data will be sent with a 

15 suitable data format on appropriate transmission frequencies and with adequate 
waveforms. Spread spectrum techniques (Frequency Hopping or Direct Sequency) 
will be also considered to improve the quality, security, and reliability of the 
transmission and to avoid interference with other radio transmissions. 
To avoid possible collisions with other aeroplanes in the collision avoidance 

20 function (or in the alarm state) when the autopilot is bringing the aircraft to the pre- 
set spatial position at a certain altitude or flight level, the system will be provided 
with the nearby aircraft position. For example, to accomplish this, the unit may 
receive information coming from General Aviation systems such as the Automatic 
Dependent Surveillance (ADS) system, which is able to transmit the aircraft 

25 position via radio link, or can receive data detected by ground radars, which will 
transmit them to the concerned aircraft in the most appropriate way (exemple, 
through the a.m. ground control station). 

To increase connectivity and minimize the number of ground control stations, the 
system may also operate through a specific satellite Wide Band Data Link 
30 connection. This will allow the aircraft to be monitored when flying over open 
oceans and improve the transmission of images in terms of speed and size, which 
could be very slow if a radio band is used. 
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Optionally, appropriate measures may be implemented in tlie unit to electronically 
scan the on board images (for example, to automatically detect the presence of 
firearms). Optionally, narcotic or poisonous gas detectors may be installed on 
board. 

5 The system also provides a function for handling the emergencies. This considers 
both the possibility that the system may be disabled under the threat of arms and 
the need for the pilot to immediately intervene in the critical phases of a real 
emergency. To achieve the first objective the system always works automatically, 
and cannot be disabled by the pilot. In case of alarm the system sends messages, 

10 incuding diabling codes. The use of secure radio bands guarantees a secure 
connection with the ground control stations and makes it possible for the aircraft to 
send automatically, if the alarm event is triggered, standard messages that inform 
the competent authorities of the onboard situation and to receive any disabling 
signals from ground. For this reason it is possible to confirm the disabling of the 

15 entire system from a ground control station or from another aircraft after checking 
the received messages (example images). This covers the risk that the system 
may be shut down by accident, by "expert" telecommunications terrorists, or under 
threat of weapons. 

To achieve the second objective, necessary to automatically disable the system 
20 through the avionic unit. A list of possible of technical-operational-structural 
serious emergencies to be stored in the unit (for example, engine failure) must be 
prepared. Real signals need to be received by the unit through specific interfaces 
with the onboard systems. When these emergencies occur, a specific software 
will immediately react, giving complete control to the pilot. The unit will then start 
25 communicating to the ground station, sending the stored and real time data and 
asking for confirmation of the disabling code. In case of confirmation the unit 
automatically disables. 

Thanks to the above characteristics and functions, the system of the invention 
provides real time information on the situation onboard the aeroplane and allows 
30 the aircraft to fly below the limit altitude or flight level only for taking off or landing, 
preventing the aircraft from descending to any point of the globe unless there is a 
real emergency on board. Thus, the system is able to manage an aircraft out of 
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route, increasing tlie flight safety , providing to ground, through secure 
communication, the onboard situation in real time. In addition, the system 
Increases the day-to-day flight safety since it provides an automatic service that 
prevents the aircraft from descending, even in the event of an error, below the 
5 minimum height established by the regulations, avoiding possible accidents due to 
human and or environmental factors. 

The system, thanks to the interfaces with the onboard systems, can optionally tal<e 
the aircraft to an autonomous landing, depending on the aircraft and airport 
equpment configuration. 
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CLAIMS 

1 . An avionic system and ground station for aircraft out of route management and 
alarm communications comprising at least an avionic device, wliicli is fitted 
onboard tlie aircraft, witli a memory unit for storing predefined information, 

5 electronic processing means for processing the received information and 
comparing it in real time with pre-set values; interfaces for receiving information 
from onboard systems and sending commands to the aircraft's autopilot to take 
over the control of the aircraft and return it to pre-set flight levels or spatial 
positions; suitable sensors for obtaining data on the aircraft onboard situation ; 

10 communication system for transmitting the onboard situation in real time to ground 
control stations and receive from the ground, or from another aircraft, appropriate 
instructions when predetermined events occur. 

2. A management system according to claim 1, wherein said predefined 
infonmation relates to flight paths, world's runways, orography of the land, 

15 obstacles and the pre-set values comprise flight paths and altitudes or flight levels. 

3. A management system according to claim 2, wherein where the aircraft 
sensors comprise surveillance video cameras and miniature transmitters, 
wearable by the flight crew, in order to obtain information for the avionic unit. 

4. A management system according to claim 3, wherein the video cameras 
20 comprise means for establishing whether they have been disabled, damaged, or 

are malfunctioning. 

5. A management system according to claim 4, wherein the sensors comprise 
heart rate monitors for the pilots to be connected to the avionic unit. 

6. A management system according to claim 4 comprising switches located in 
25 specific points of the aircraft available to crew and passengers to obtain 

information for the avionic unit, and a cockpit automatic locking system. 

7. A management system according to claim 4 comprising, in the event of an 
emergency, means suitable for externally and/or automatically disabling the 
collision avoidance system in accordance to predefined rules. 

30 8- A management system as claimed in one of the previous claims, comprising 
means for encrypting and coding the signals exchanged between the aircraft and 
the ground control station not interfearing with the radio band communications. 
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9. A ground control station suitable for interfacing with the system of claim 1 
comprising at least a computer for processing the received data, a transmission- 
reception radio system, an encrypting and/or coding system, and an audio-visual 
communications system. 
5 10. A method for aircraft out of route management comprising the following steps: 

Defining first data for a collision avoidance function and loading said data into 
the aircraft avionic unit, 

Defining second data for an alarm function and loading said data into the 
aircraft avionic unit, 

10 - Defining third data for at least one ground control station and loading said data 
into the station, 

Defining interfaces. 

Defining communication channels and their respective properties, 
Defining sensors, transmitters, switches, and video cameras, 
15 - Determining operating logics of the collision avoidance function and their 

implementation in the avionic unit. 

Determining operating logics of the alarm function and their implementation in 

the avionic unit, 

Determining operating logics of the ground control station and loading them 
20 into the station. 

1 1 . Method according to claim 9 wherein the electronic processing means process 
received information and compare it in real time with data referring to pre-set flight 
paths and allowed altitudes or flight levels, and wherein the interfaces receive 
flight information from onboard systems and send commands to the aircraft's 

25 autopilot to take over the control of the aircraft and bring it back to pre-set altitudes 
or flight levels or spatial positions, and wherein sensors obtain data on the 
situation onboard the aircraft, and wherein the communication means and the 
connecting interfaces transmit information relating to onboard situation in real time 
to ground control stations and receive appropriate instructions from the ground 

30 control station or from another aircraft when predetermined events occur. 
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AVIONIC SYSTEM AND GROUND STATION FOR AIRCRAFT OUT OF ROUTE 

MANAGEMENT AND ALARM COMMUNICATIONS 

Abstract 

An avionic (flying electronic unit) system and ground station for aircraft out of route 
5 management and alarm communications composed of an avionic device, which is 
fitted onboard the aircraft, with a memory unit for storing the flight paths data, 
runways, orography, and obstacles; processors to compute the stored or received 
data, available from sensors monitoring the onboard situation. Processors will 
compute commands to be sent to the aircraft's autopilot to temporarily take over 
10 the aircraft control and return it to pre-set flight levels or spatial positions; 
communication devices suitable for transmitting the real time onboard situation to 
ground control stations when potentially dangerous events occur. 
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